Researcher flags fake Google Chrome download site geoogle.top pushing installer ZIP from lestvnas.icu
@Malwarehunterr reported on 1 November 2026 that geoogle.top imitates Google's Chrome download page and redirects to an installer archive on lestvnas.icu. The download link was down and the payload is unverified. Google is not involved.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Security researcher @Malwarehunterr posted on X on 1 November 2026 about what they called “More Fake Google Chrome Download Sites”. According to the post, geoogle.top impersonates Google's Chrome download page in Chinese and redirects users to a suspicious installer archive. The post lists these indicators of compromise: geoogle.top, lestvnas.icu and the download path lestvnas.icu/mios_googleChrocmeSetup_628.92547.zip. It also gives a SHA-256 hash for a dropped file (04395a955f57f772cfb4d0d6161bf085c48e6d55ed6fc7cbbf522867099957d7) and names a similar site. Google is not involved: the domain is not a Google address, and “geoogle” is a misspelling of the real name.
How the scam works
The screenshot in the post shows a page in Chinese headed with the Chrome logo and a large blue “Download Chrome” button for Windows. A second screenshot in the thread shows a similar page on ggoogle.cc, and a VirusTotal page for geoogle.top shows the domain was registered only a day earlier. Pages of this kind are a common way to spread malware. People searching for a browser, or sent a link in an ad or message, land on a lookalike page. The button then delivers an archive from a different server instead of Google's installer. Here the researcher says the archive came from lestvnas.icu and carries a filename that copies Chrome's name.
The researcher adds two cautions: the download link was down when they checked, and the payload remains unverified, so the post does not say what the file actually does. An installer from an unofficial site can carry anything from adware to password-stealing malware or remote-access tools, which is why an unexpected ZIP of “Chrome” is a warning sign in itself.
Google distributes Chrome only through its own official site and the app stores. Chrome also updates itself, so there is no need to download it from any other address.
Source
@Malwarehunterr on X, post of 1 November 2026 (indicators and screenshots). Not independently verified by scammers.com.
Red flags
- A Chrome download page on a misspelled domain such as geoogle.top rather than google.com.
- A download button that delivers a ZIP archive from another domain (lestvnas.icu) instead of an installer from Google.
- A file name copying Chrome's name with odd numbers, such as mios_googleChrocmeSetup_628.92547.zip.
- A very recently registered domain imitating a well-known software brand.
- A software page that was reached through an ad, message or search result rather than the official site.
If you were targeted
- 1Do not visit geoogle.top or run any file from lestvnas.icu.
- 2If you ran the file, disconnect from the network, scan with a trusted security tool and change passwords from a clean device.
- 3Download Chrome only from google.com/chrome or your device's official app store.
- 4Keep Chrome and your operating system updated through their built-in update tools.
- 5Check the spelling of a web address before downloading anything from it.